Before
After closing a vulnerability ticket, security teams had to manually start a new scan, wait for its completion, compare the results with the original finding, and update the ticket. This required switching between ServiceNow, asset information, and scanning tools, which could delay or make follow-up inconsistent.
How it works
- When a ServiceNow ticket closes, the workflow retrieves the record, identifies the affected asset and finding, and obtains the asset details needed for verification.
- It locates the asset in Tenable, launches a targeted scan, and polls until the scan completes before retrieving the results.
- It compares the scan results with the original vulnerability and either re-opens the ticket with findings or completes the workflow when remediation is confirmed.
Workflow details
- Closure trigger and record review: The workflow starts when a ServiceNow ticket is closed through a business-rule notification. It retrieves the ticket details, including the description, comments, close notes, and other relevant fields, then extracts the affected asset and vulnerability information from the record.
- Asset and scan preparation: Asset details are retrieved from Hackuity and used to locate the corresponding asset in Tenable. The workflow retrieves available scanners and launches a targeted scan against the affected asset rather than requiring a broader manual scan.
- Automated scan monitoring: After launching the scan, the workflow checks its progress repeatedly, waiting 60 seconds between status checks until Tenable reports that the scan is complete. Once finished, it retrieves the completed scan results for analysis.
- Remediation verification: An AI agent compares the completed scan findings with the original ticket information to determine whether the vulnerability remains present. This creates a consistent verification step for every closed ticket.
- Outcome-based ticket handling: If the vulnerability persists, the workflow re-opens the ServiceNow ticket and appends the remediation findings. If the vulnerability is confirmed as fixed, the workflow completes successfully without further ticket action.
What changed
Every closed vulnerability ticket now receives an automated re-verification sequence before remediation is considered confirmed. The workflow performs the asset lookup, targeted scan, completion checks, result comparison, and ticket update automatically, leaving analysts to follow up only when the vulnerability persists.
Work removed
Manually triggering a targeted scan, waiting for scan completion, checking the results against the original vulnerability, switching between tools, and updating or re-opening the ServiceNow ticket.
Expected outcome
A consistent remediation check for every closed ticket, with an estimated 10–15 minutes saved per closure review.
